CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability

Tech Times reports that once an attacker can run code as the Zammad service user, "this flaw lets them escalate from that low-privilege account to root on the host system."[2]According to the HOL Blog, DIVD published the CVEs under case DIVD-2026-00015 after investigating its own network breach[3]. Security.NL reports that DIVD said AI agents had used the two Zammad vulnerabilities[1].The HOL Blog reports that CISA added CVE-2026-102489 and CVE-2026-102490 to the Known Exploited Vulnerabilities catalog[3] on October 2, and that CISA notes the two can be chained. KEV due date is 2026-10-05.[3]The HOL Blog says DIVD lists affected from 1.5.0 before 7.1.0-alpha[3]. The blog adds that DIVD rates the flaw CVSS 4.0 base 8.5 High[3], while Strix lists it as critical, rated 9.4/10[4].According to the HOL Blog, Zammad's community thread says it received technical details from DIVD and is working the fix, and that this issue cannot be exploited remotely on its own[3].Tech Times reports that upgrading to version 7 does not patch CVE-2026-102490[2]. The HOL Blog advises that until you are on 7.2.0, keep the Zammad UI off the public internet if you can[3].According to Tech Times, the Dutch NCSC advises making a copy of your application and network logs before installing the update[2].